CVE-2019-12452

Signals

NVD · CVE-2026-18980 · 6.3 · A vulnerability was identified in nearai ironclaw up to 0.29.1. Affected is the function classify_command_risk of the file src/tools/builtin/shell.rs. Such maniNVD · CVE-2026-18976 · 6.3 · A vulnerability was determined in NousResearch hermes-agent up to 0.16.0. This impacts the function get_tool_definitions of the file agent/agent_init.py of the NVD · CVE-2026-18974 · 5.3 · A vulnerability was found in heshengtao super-agent-party up to 0.4.1. This affects the function get_file_content of the file server.py of the component executeNVD · CVE-2026-18973 · 7.3 · A vulnerability has been found in heshengtao super-agent-party up to 0.4.1. The impacted element is the function sanitize_proxy_url of the file server.py of theCISA KEV · CVE-2026-63077 · 9.8 · JetBrains TeamCity Deserialization of Untrusted Data Vulnerability · Added 2026-08-05 · Due 2026-08-08CISA KEV · CVE-2026-18556 · 7.4 · N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability · Added 2026-08-04 · Due 2026-08-07NVD · CVE-2026-18980 · 6.3 · A vulnerability was identified in nearai ironclaw up to 0.29.1. Affected is the function classify_command_risk of the file src/tools/builtin/shell.rs. Such maniNVD · CVE-2026-18976 · 6.3 · A vulnerability was determined in NousResearch hermes-agent up to 0.16.0. This impacts the function get_tool_definitions of the file agent/agent_init.py of the NVD · CVE-2026-18974 · 5.3 · A vulnerability was found in heshengtao super-agent-party up to 0.4.1. This affects the function get_file_content of the file server.py of the component executeNVD · CVE-2026-18973 · 7.3 · A vulnerability has been found in heshengtao super-agent-party up to 0.4.1. The impacted element is the function sanitize_proxy_url of the file server.py of theCISA KEV · CVE-2026-63077 · 9.8 · JetBrains TeamCity Deserialization of Untrusted Data Vulnerability · Added 2026-08-05 · Due 2026-08-08CISA KEV · CVE-2026-18556 · 7.4 · N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability · Added 2026-08-04 · Due 2026-08-07

CVE Database · CVE-2019-12452

CVE-2019-12452

· N/AModified

CVSS v3.1

N/A

EPSS

2.59%

Published

May 29, 2019

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

types/types.go in Containous Traefik 1.7.x through 1.7.11, when the --api flag is used and the API is publicly reachable and exposed without sufficient access control (which is contrary to the API documentation), allows remote authenticated users to discover password hashes by reading the Basic HTTP Authentication or Digest HTTP Authentication section, or discover a key by reading the ClientTLS section. These can be found in the JSON response to a /api request.

Weaknesses (CWE)

CWE-522

Affected Products (1)

traefik · traefikvulnerable

References (6)

https://docs.traefik.io/configuration/api/#security

ExploitVendor Advisory

https://github.com/containous/traefik/issues/4917

ExploitThird Party Advisory

https://github.com/containous/traefik/pull/4918

ExploitPatchThird Party Advisory

https://docs.traefik.io/configuration/api/#security

ExploitVendor Advisory

https://github.com/containous/traefik/issues/4917

ExploitThird Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs